…without snark or jumping down my throat. I genuinely want to know why it’s so unsafe.
I’m running a Synology DS920+, with my DSM login exposed through a Cloudflare tunnel. I have 2FA enabled, Synology firewall enabled with these rules in place. I also have this IP blocklist enabled.
After all of this, how would someone be able to break in via the DSM login?
With cloudflare authen it is probably gonna be fine with ip block filter etc. it would probably filter 99.999% of the malicious attack already.
But still why do you need to expose it? I only have my jellyfin expose cos idc much about jf data and network cos it on a separate vlan network and stuff. All my management and nas are only accessible through vpn cos i wouldnt need access outside that often only when something happends.
because attackers can now access it. this gives them unlimited amount of times to try and break in. this isn’t as safe as not exposing it to attackers.
Security for systems are designed for their target use case. The NAS login page was designed to be easily usable and assumed to only live within a private network. By opening to the internet you are opening it up to be targeted in a way the designers may not have accounted for.
if you must, have you looked at the azure application proxy? if you configure it properly it should work from the outside world, and still remain private. This does put a lost of trust into azure, and your tenant’s users not getting broken into.
Surprised no one posted this, the web and cyber threat look like that : https://livethreatmap.radware.com/
I wouldn’t trust Synology on that aspect, better have an entry over VPN.
